@@ -30,7 +30,7 @@ Miasm is a free and open source (GPLv2) reverse engineering framework.
30
30
Miasm aims to analyze / modify / generate binary programs. Here is
31
31
a non exhaustive list of features:
32
32
33
- * Opening / modifying / generating PE / ELF 32 / 64 LE / BE using Elfesteem
33
+ * Opening / modifying / generating PE / ELF 32 / 64 LE / BE
34
34
* Assembling / Disassembling X86 / ARM / MIPS / SH4 / MSP430
35
35
* Representing assembly semantic using intermediate language
36
36
* Emulating using JIT (dynamic code analysis, unpacking, ...)
@@ -47,8 +47,8 @@ Assembling / Disassembling
47
47
48
48
Import Miasm x86 architecture:
49
49
``` pycon
50
- >>> from miasm2 .arch.x86.arch import mn_x86
51
- >>> from miasm2 .core.locationdb import LocationDB
50
+ >>> from miasm .arch.x86.arch import mn_x86
51
+ >>> from miasm .core.locationdb import LocationDB
52
52
```
53
53
Get a location db:
54
54
@@ -58,38 +58,38 @@ Get a location db:
58
58
Assemble a line:
59
59
``` pycon
60
60
>>> l = mn_x86.fromstring(' XOR ECX, ECX' , loc_db, 32 )
61
- >>> print l
61
+ >>> print (l)
62
62
XOR ECX, ECX
63
63
>>> mn_x86.asm(l)
64
64
['1\xc9', '3\xc9', 'g1\xc9', 'g3\xc9']
65
65
```
66
66
Modify an operand:
67
67
``` pycon
68
68
>>> l.args[0 ] = mn_x86.regs.EAX
69
- >>> print l
69
+ >>> print (l)
70
70
XOR EAX, ECX
71
71
>>> a = mn_x86.asm(l)
72
- >>> print a
72
+ >>> print (a)
73
73
['1\xc8', '3\xc1', 'g1\xc8', 'g3\xc1']
74
74
```
75
75
Disassemble the result:
76
76
``` pycon
77
- >>> print mn_x86.dis(a[0 ], 32 )
77
+ >>> print ( mn_x86.dis(a[0 ], 32 ) )
78
78
XOR EAX, ECX
79
79
```
80
80
Using ` Machine ` abstraction:
81
81
82
82
``` pycon
83
- >>> from miasm2 .analysis.machine import Machine
83
+ >>> from miasm .analysis.machine import Machine
84
84
>>> mn = Machine(' x86_32' ).mn
85
- >>> print mn.dis(' \x33\x30 ' , 32 )
85
+ >>> print ( mn.dis(' \x33\x30 ' , 32 ) )
86
86
XOR ESI, DWORD PTR [EAX]
87
87
```
88
88
89
89
For Mips:
90
90
``` pycon
91
91
>>> mn = Machine(' mips32b' ).mn
92
- >>> print mn.dis(' 97A30020 ' .decode( ' hex ' ) , " b" )
92
+ >>> print ( mn.dis(b ' \x97\xa3\x00 ' , " b" ) )
93
93
LHU V1, 0x20(SP)
94
94
```
95
95
Intermediate representation
@@ -99,8 +99,8 @@ Create an instruction:
99
99
100
100
``` pycon
101
101
>>> machine = Machine(' arml' )
102
- >>> instr = machine.mn.dis(' 002088e0 ' .decode( ' hex ' ) , ' l' )
103
- >>> print instr
102
+ >>> instr = machine.mn.dis(' \x00 \x88\xe0 ' , ' l' )
103
+ >>> print ( instr)
104
104
ADD R2, R8, R0
105
105
```
106
106
@@ -120,7 +120,7 @@ Add instruction to the pool:
120
120
Print current pool:
121
121
``` pycon
122
122
>>> for lbl, irblock in ircfg.blocks.items():
123
- ... print irblock.to_string(loc_db)
123
+ ... print ( irblock.to_string(loc_db) )
124
124
loc_0:
125
125
R2 = R8 + R0
126
126
@@ -133,9 +133,9 @@ Working with IR, for instance by getting side effects:
133
133
... for assignblk in irblock:
134
134
... rw = assignblk.get_rw()
135
135
... for dst, reads in rw.iteritems():
136
- ... print ' read: ' , [str (x) for x in reads]
137
- ... print ' written:' , dst
138
- ... print
136
+ ... print ( ' read: ' , [str (x) for x in reads])
137
+ ... print ( ' written:' , dst)
138
+ ... print ()
139
139
...
140
140
read: ['R8', 'R0']
141
141
written: R2
@@ -164,21 +164,21 @@ Giving a shellcode:
164
164
Import the shellcode thanks to the ` Container ` abstraction:
165
165
166
166
``` pycon
167
- >>> from miasm2 .analysis.binary import Container
167
+ >>> from miasm .analysis.binary import Container
168
168
>>> c = Container.from_string(s)
169
169
>>> c
170
- <miasm2 .analysis.binary.ContainerUnknown object at 0x7f34cefe6090>
170
+ <miasm .analysis.binary.ContainerUnknown object at 0x7f34cefe6090>
171
171
```
172
172
173
173
Disassembling the shellcode at address ` 0 ` :
174
174
175
175
``` pycon
176
- >>> from miasm2 .analysis.machine import Machine
176
+ >>> from miasm .analysis.machine import Machine
177
177
>>> machine = Machine(' x86_32' )
178
178
>>> mdis = machine.dis_engine(c.bin_stream)
179
179
>>> asmcfg = mdis.dis_multiblock(0 )
180
180
>>> for block in asmcfg.blocks:
181
- ... print block.to_string(asmcfg.loc_db)
181
+ ... print ( block.to_string(asmcfg.loc_db) )
182
182
...
183
183
loc_0
184
184
LEA ECX, DWORD PTR [ECX + 0x4]
@@ -208,7 +208,7 @@ Initializing the Jit engine with a stack:
208
208
Add the shellcode in an arbitrary memory location:
209
209
``` pycon
210
210
>>> run_addr = 0x 40000000
211
- >>> from miasm2 .jitter.csts import PAGE_READ , PAGE_WRITE
211
+ >>> from miasm .jitter.csts import PAGE_READ , PAGE_WRITE
212
212
>>> jitter.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE , s)
213
213
```
214
214
@@ -284,15 +284,15 @@ Initializing the IR pool:
284
284
Initializing the engine with default symbolic values:
285
285
286
286
``` pycon
287
- >>> from miasm2 .ir.symbexec import SymbolicExecutionEngine
287
+ >>> from miasm .ir.symbexec import SymbolicExecutionEngine
288
288
>>> sb = SymbolicExecutionEngine(ira)
289
289
```
290
290
291
291
Launching the execution:
292
292
293
293
``` pycon
294
294
>>> symbolic_pc = sb.run_at(ircfg, 0 )
295
- >>> print symbolic_pc
295
+ >>> print ( symbolic_pc)
296
296
((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)
297
297
```
298
298
@@ -355,7 +355,7 @@ ________________________________________________________________________________
355
355
Retry execution with a concrete ECX. Here, the symbolic / concolic execution reach the shellcode's end:
356
356
357
357
``` pycon
358
- >>> from miasm2 .expression.expression import ExprInt
358
+ >>> from miasm .expression.expression import ExprInt
359
359
>>> sb.symbols[machine.mn.regs.ECX ] = ExprInt(- 3 , 32 )
360
360
>>> symbolic_pc = sb.run_at(ircfg, 0 , step = True )
361
361
Instr LEA ECX, DWORD PTR [ECX + 0x4]
@@ -525,7 +525,6 @@ Miasm uses:
525
525
526
526
* python-pyparsing
527
527
* python-dev
528
- * elfesteem from [ Elfesteem] ( https://github.com/serpilliere/elfesteem.git )
529
528
* optionally python-pycparser (version >= 2.17)
530
529
531
530
To enable code JIT, one of the following module is mandatory:
@@ -539,14 +538,6 @@ To enable code JIT, one of the following module is mandatory:
539
538
Configuration
540
539
-------------
541
540
542
- * Install elfesteem
543
- ``` pycon
544
- git clone https://github.com/serpilliere/elfesteem.git elfesteem
545
- cd elfesteem
546
- python setup.py build
547
- sudo python setup.py install
548
- ```
549
-
550
541
To use the jitter, GCC or LLVM is recommended
551
542
* GCC (any version)
552
543
* Clang (any version)
@@ -570,8 +561,8 @@ Windows & IDA
570
561
571
562
Most of Miasm's IDA plugins use a subset of Miasm functionality.
572
563
A quick way to have them working is to add:
573
- * ` elfesteem ` directory and ` pyparsing.py ` to ` C:\...\IDA\python\ ` or ` pip install pyparsing elfesteem `
574
- * ` miasm2/miasm2 ` directory to ` C:\...\IDA\python\ `
564
+ * ` pyparsing.py ` to ` C:\...\IDA\python\ ` or ` pip install pyparsing `
565
+ * ` miasm/miasm ` directory to ` C:\...\IDA\python\ `
575
566
576
567
All features excepting JITter related ones will be available. For a more complete installation, please refer to above paragraphs.
577
568
@@ -598,7 +589,7 @@ Tools
598
589
-----
599
590
600
591
* [ Sibyl] ( https://github.com/cea-sec/Sibyl ) : A function divination too
601
- * [ R2M2] ( https://github.com/guedou/r2m2 ) : Use miasm2 as a radare2 plugin
592
+ * [ R2M2] ( https://github.com/guedou/r2m2 ) : Use miasm as a radare2 plugin
602
593
* [ CGrex] ( https://github.com/mechaphish/cgrex ) : Targeted patcher for CGC binaries
603
594
* [ ethRE] ( https://github.com/jbcayrou/ethRE ) Reversing tool for Ethereum EVM (with corresponding Miasm2 architecture)
604
595
0 commit comments